electron-updater
Cross platform updater for electron applications
87%
Total Score
100
100
94
67
100
Health Score Breakdown
The linked repository name does not match electron-updater and its README does not mention the package, so the package-to-repository relationship is not directly demonstrated despite the organization-backed monorepo context.
No repository security policy was found, leaving vulnerability reporting and response expectations less transparent for a package with update functionality.
All nine workflows were analyzed with no untrusted checkout or script-injection findings and 36 of 36 action references pinned. A high-confidence low-severity adhoc-packages finding remains because a release workflow installs outside a lockfile, while two workflows have broad write permissions.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-757462 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. electron-updater is vulnerable to Path Traversal in versions 6.1.1 - 6.8.7. | 6.1.1 - 6.8.7 | Medium |
CVE-2024-39698 electron-updater is vulnerable to Improper Neutralization of Variable Name Delimiters in versions 0.0.0 - 6.3.0-alpha.5. | 0.0.0 - 6.3.0-alpha.5 | High |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 semver Version ~7.7.3 | — | — |
js-yaml Version ^4.1.0 | — | — |
fs-extra Version ^10.1.0 | — | — |
lazy-val Version ^1.0.5 | — | — |
lodash.isequal Version ^4.5.0 | — | — |
Weekly Downloads
Info
- Last Published
- 4 months ago
- Created
- 11 years ago
- Unpacked Size
- 0.6 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.